admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

scripts: the banned-entry gate must read directives, not comments

Browse Source 
The v1.22.0 gate asserts the rendered grub.cfg has no live reference to
proxtui/proxdebug/nomodeset/Rescue Boot/memtest/fwsetup. It grepped the whole
file, so the template's own header — which documents exactly which stock entries
were dropped, and names them — tripped it. Caught on the first canary build:
fail-closed, no ISO produced, which is the behavior we want from a safety gate
that is wrong.

Strip comments before matching. A comment naming a removed entry is the point;
a directive using one is the bug.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE
This commit is contained in:
authentik Default Admin
2026-07-19 08:49:02 +02:00
parent f3d1ba3062
commit aed7f33f3c
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/iso/iso-repack.sh
+5 -2
View File
@@ -154,9 +154,12 @@ if [[ "$BRAND" == "1" ]]; then
N_SUB="$(grep -c '^[[:space:]]*submenu ' "$GCFG" || true)" N_SUB="$(grep -c '^[[:space:]]*submenu ' "$GCFG" || true)"
[[ "$N_ENTRY" == "1" ]] || { echo "iso-repack: rendered grub.cfg has $N_ENTRY menuentries, want exactly 1" >&2; exit 14; } [[ "$N_ENTRY" == "1" ]] || { echo "iso-repack: rendered grub.cfg has $N_ENTRY menuentries, want exactly 1" >&2; exit 14; }
[[ "$N_SUB" == "0" ]] || { echo "iso-repack: rendered grub.cfg has $N_SUB submenus, want 0" >&2; exit 14; } [[ "$N_SUB" == "0" ]] || { echo "iso-repack: rendered grub.cfg has $N_SUB submenus, want 0" >&2; exit 14; }
# Strip comments first: the template's header EXPLAINS which stock entries were dropped, and
# naming them there must not trip the gate. What matters is that no live directive uses them.
LIVE="$(grep -v '^[[:space:]]*#' "$GCFG")"
for banned in proxtui proxdebug nomodeset 'Rescue Boot' memtest fwsetup; do for banned in proxtui proxdebug nomodeset 'Rescue Boot' memtest fwsetup; do
if grep -q "$banned" "$GCFG"; then if grep -q "$banned" <<<"$LIVE"; then
echo "iso-repack: rendered grub.cfg still references '$banned'" >&2; exit 14 echo "iso-repack: rendered grub.cfg still has a live reference to '$banned'" >&2; exit 14
fi fi
done done
grep -q "set theme=/boot/grub/felhomtheme/theme.txt" "$GCFG" \ grep -q "set theme=/boot/grub/felhomtheme/theme.txt" "$GCFG" \